9.8
Critical
CVE-2026-49980 Rclone is a command-line program to sync files and directories to and from different cloud storage providers
Description
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during initialization. As a result, a single unauthenticated GET or HEAD request can execute a command as the rclone process user. This vulnerability is fixed in 1.74.3.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| rclone 1.46 | 1.46.0 → < 1.74.3 | 1.74.3 |
| OpenShift API for Data Protection | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published | |
| Cryostat 4 | Versions not published |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of rclone
The 42 CVEs of rclone →
CVE-2026-116196
Rclone before v1.75.2 B2 Credential Leak on Redirect via --b2-download-url
6.0
Medium
CVE-2026-116195
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which…
7.0
High
CVE-2026-116194
Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost…
7.6
High
CVE-2026-116192
rclone from 1.37 before 1.74.2 SSRF via --rc-serve scheme-relative remote roots
8.2
High